@andrian.yablonskyy/thub-common 1.0.21 → 1.0.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-common",
-  "version": "1.0.21",
+  "version": "1.0.22",
   "description": "Shared job-spec schema, state enums and a thin API client used by the Agent and Client",
   "main": "src/index.js",
   "files": [

package/src/job-spec.schema.js

@@ -18,6 +18,10 @@
 const DOCKER_IMAGE_PATTERN =
     '^[A-Za-z0-9][A-Za-z0-9.-]*(:[0-9]+)?(/[a-z0-9]+((\\.|_|__|-+)[a-z0-9]+)*)*(:[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?(@sha256:[a-f0-9]{64})?$',
 
+  // A git branch or tag name: no leading "-" or "/", no "..", no spaces or
+  // the characters git forbids (~^:?*[\), not ending in "/", ".lock" or ".".
+  GIT_REF_PATTERN = '^(?![-/])(?!.*\\.\\.)(?!.*//)(?!.*(/|\\.lock|\\.)$)[A-Za-z0-9._/+@-]+$',
+
   // Matches the job spec shape documented in README.md §4.3.
   // Deliberately has no field for shell commands: the Client only ever
   // runs the fixed entry point from the downloaded test package — the
@@ -66,12 +70,31 @@ const DOCKER_IMAGE_PATTERN =
           flashAddress: { type: 'string' }
         }
       },
+      // Where the tests come from — exactly one of `url` (an archive: tar in
+      // any compression, or zip) or `git` (a repository at a branch, tag or
+      // commit; default: its default branch) — and how they start: `command`
+      // (a shell command run in the sources, if the Client allows it:
+      // allowJobCommands), else the package's own run-tests.sh. Combinations
+      // are checked in validate-job-spec.js.
       tests: {
         type: 'object',
         additionalProperties: false,
-        required: ['url'],
         properties: {
           url: { type: 'string', format: 'uri' },
+          git: {
+            type: 'object',
+            additionalProperties: false,
+            required: ['url'],
+            properties: {
+              url: { type: 'string', minLength: 1, maxLength: 2048 },
+              // Ref names as git allows them — never starting with "-",
+              // so none can be taken for a git option.
+              branch: { type: 'string', maxLength: 255, pattern: GIT_REF_PATTERN },
+              tag: { type: 'string', maxLength: 255, pattern: GIT_REF_PATTERN },
+              commit: { type: 'string', pattern: '^[0-9a-fA-F]{7,40}$' }
+            }
+          },
+          command: { type: 'string', minLength: 1, maxLength: 4096 },
           suite: { type: 'string', default: 'default' },
           args: { type: 'array', items: { type: 'string' }, default: [] }
         }

package/src/validate-job-spec.js

@@ -29,10 +29,39 @@ function validateJobSpec(spec){
   const clone = JSON.parse(JSON.stringify(spec ?? {})),
     schemaValid = validateFn(clone),
     errors = schemaValid ? [] : (validateFn.errors || []).map((e) => `${e.instancePath || '/'} ${e.message}`);
-  errors.push(...firmwareErrors(clone));
+  errors.push(...firmwareErrors(clone), ...testsErrors(clone));
   return { valid: errors.length === 0, spec: clone, errors };
 }
 
+// Git transports a Client may fetch test sources over. Never `ext::` (runs
+// a command), `file://` or a local path: the Client also sets
+// GIT_ALLOW_PROTOCOL to the same list (downloader.js).
+const GIT_URL = /^(?:(?:https?|ssh|git):\/\/[^\s]+|[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:[^\s]+)$/;
+
+// tests.url (archive) vs tests.git (repo + at most one of branch/tag/commit).
+function testsErrors(spec){
+  const tests = spec.tests;
+  if (!tests || typeof tests !== 'object'){
+    return [];
+  }
+  if (tests.url && tests.git){
+    return ['/tests give either url (an archive) or git (a repository), not both'];
+  }
+  if (!tests.url && !tests.git){
+    return ['/tests needs url (an archive: tar/tar.gz/zip) or git (a repository)'];
+  }
+  if (tests.git){
+    if (!GIT_URL.test(tests.git.url || '')){
+      return ['/tests/git/url must be an https://, http://, ssh:// or git:// URL, or user@host:path'];
+    }
+    const refs = ['branch', 'tag', 'commit'].filter((k) => tests.git[k]);
+    if (refs.length > 1){
+      return [`/tests/git give at most one of branch, tag or commit (got ${refs.join(', ')})`];
+    }
+  }
+  return [];
+}
+
 // firmware.url vs firmware.image — spelled out here rather than as schema
 // oneOf/if-then, whose errors ("must match exactly one schema") say little.
 function firmwareErrors(spec){